4

I have a webserver which is hosted on mosso- Ubuntu 8.04. It does not have Cpanel installed. I wanted know if anyone can recommend any good services to harden my server from hacking etc. I tried platinumservermanagement but they said that they need Cpanel and wont do it on a regular server.

I am wondering if there are any good services out there (within $50 preferably) to harden my server.

Thank you for your time.

elated
  • 289
  • 5
  • 13
  • 1
    +1 for hiring someone to do the job properly. This is not the place for self-marketing, but we offer that at Sucuri (look at my profile if you are interested). – sucuri Jul 25 '09 at 13:42
  • whoever you choose, ensure that you run aide on the box first to see what they change - then you can learn from them, and make sure they've done a thorough job. – gbjbaanb Jul 26 '09 at 13:49

4 Answers4

9

I'm not sure how I can contact you 'off-site' but for the purpose of the thread, here are the basics:

1) Disable unnecessary services. Ubuntu isn't my strongpoint, but, I believe debian systems use 'rcconf' to switch off services. You can also modify the files directly in /etc/rc.d. You don't want to run anything that could leave you vulnerable, or require patching if you don't need the service so it's easier just to switch off

2) IPtables. Deny by default and open up services you need such as SSH and WWW. You should also block outbound IP traffic and whitelist those services you need. In the past I've been rooted by a PHP script with poor security which was used to upload a script which downloaded a more potent payload from a remote server. If outbound traffic was denied by default it could have saved me.

3) SSH, turn off password logins and use public/private key pairs instead

4) Install logwatch and check your system daily, this will enable you to spot if something changes

5) Remote logging, if you have the opportunity, log to a remote syslog host, this way you'll have logs if your system is compromised

6) Backups and recovery plan, whilst not part of security, it's comforting to know you can recover your system with minimum impact.

Anyone else want to contribute?

Andrew Taylor
  • 884
  • 4
  • 6
3

Recognising that securing a server is not an easy one time job is something I wish more web server owners would do, so congrats to you there.

While it isn't an easy one-time job, it is though not too difficult a job if you have time to learn the current threats and the time to keep abreast of any new threats. Simply following accepted good practise (proper password policies, being careful with you SSH/Apache/<whatever> configuration, keeping up-to-date with security patches, having a reasonable firewall setup, ...) and keeping up-to-date with security news will do the trick.

If you don't have the time or the inclination for the above (many don't, and those some who don't but think they do are a menace to themselves and the rest of the network!) then the other option is to employ a server management service. You'll find them advertising, and being discussed, at places geared around web/other hosting solutions like the webhostingtalk forums (http://www.webhostingtalk.com/) and their many kin. A good server management plan will get your server initially hardened and will see it monitored, patched and tweaked as needed. But you will lose some level of control as you will have to inform them of changes that you plan otherwise any guarantee that comes with the service will be void (they won't guarantee their work if your subsequent changes impact upon it).

I don't have any specific recommendations unfortunately as I'm a DIY (or at least do-it-within-the-company-perhaps-with-a-little-outside-consultation) man myself and have not used such services, and I'm guessing most posters on serverfault will be in a similar position. One thing I can say is that getting a good service probably isn't going to be particularly cheap - if you pay peanuts you'll get monkey's and you don't want faeces thrown at your server(s). Bad third-party server management can be worse than none at all as it will give you a false sense of safety while offering no real benefit at all.

Another option is to have your server and apps professionally penetration tested. This will give you a good detailed report of any major/middling/minor issues that exist, but will be expensive, will need to be repeated occasionally, and they will only test (you will have to devise and apply any changes needed to resolve weaknesses found).

David Spillett
  • 22,534
  • 42
  • 66
2

if you would like to take care of hardening by yourself - take a look here.

Community
  • 1
pQd
  • 29,561
  • 5
  • 64
  • 106
  • 1
    i want to avoid that and get a professional to do it honestly. – elated Jul 25 '09 at 11:42
  • 4
    @elated ok - but remember. it's process not a project. it's not one time job. you'll need to have someone to look after the server from time to time - do system upgrade, sanity check of file permissions etc. – pQd Jul 25 '09 at 11:50
  • not a problem. but where do i find such a service? – elated Jul 25 '09 at 12:16
  • i cannot recommend you specific company, but you can find knowledgeable people at http://www.webhostingtalk.com/. – pQd Jul 25 '09 at 12:28
0

Atomic Secured Linux It is a 99% solution to most issues, if you want to have it professional installed and maintained please contact me.

Greg Colbert
  • 11
  • 2